PT-2024-34323 · Auburnforest · Datamentor

Name of the Vulnerable Software and Affected Versions: Auburnforest DataMentor versions n/a through 1.7 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This means that an attacke...

PT-2024-34333 · Sided · Sided

Name of the Vulnerable Software and Affected Versions: Sided versions n/a through 1.4.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This enables potential attackers to inject maliciou...

PT-2024-35003 · Unknown · Matorel Multi-Day Booking Calendar

Name of the Vulnerable Software and Affected Versions: matorel Multi-day Booking Calendar versions n/a through 1.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

(0Day) Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2024-34970 · Unknown · Sazzad Hu Image Carousel Shortcode

Name of the Vulnerable Software and Affected Versions: Sazzad Hu Image Carousel Shortcode versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that the...

(0Day) Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

The vulnerability of the final point of the Splunk Enterprise data model/web REST platform for operational analysis allows a malicious actor to trigger a service failure.

The vulnerability of the final point of the Splunk Enterprise data model/web REST platform for operational analysis is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially creat...

PT-2024-35189 · Unknown · Aa Audio Player

Name of the Vulnerable Software and Affected Versions: AA Audio Player versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. Specifically, it is a DOM-Based XSS vulnerability. This means...

WAGO多款产品 安全漏洞

WAGO PFC100 and others are products of WAGO, Germany.WAGO PFC100 is a programmable logic controller PLC.WAGO CC100 0751-9x01 is a compact controller.WAGO Edge Controller 0752-8303/8000-0002 is a controller. A security vulnerability exists in various WAGO products. The vulnerability stems from the...

Calibre-Web 跨站脚本漏洞

Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B, an individual developer. Calibre-Web suffers from a cross-site scripting vulnerability that originates from inserting user input directly into the DOM without proper cleanup. An...

PT-2024-16860 · Code Projects · Code-Projects Inventory Management

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management version 1.0 Description: A critical issue has been identified, affecting the /model/editProduct.php file. The manipulation of the id argument leads to SQL injection. This issue can be exploited remotely...

Code-Projects Inventory Management System 注入漏洞

Inventory Management is an inventory management system. Inventory Management suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the id parameter of the /model/editProduct.php file. An attacker can exploit this vulnerability to...

Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx

...

Cross-Site Scripting (XSS)

github.com/mudler/localai is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper input validation and inadequate sanitization of user inputs when passing parameters to the delete model API, allows malicious scripts to be stored and executed in the application...

Medium: nodejs20

Issue Overview: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actor...

The vulnerability of the opennurbs.dll library, a software for modeling, designing, and drafting in AutoCAD, allows a malicious actor to cause the application to terminate abnormally or execute arbitrary code.

The vulnerability of the opennurbs.dll library, a software component used for modeling, designing, and drafting in AutoCAD, relates to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow an attacker to cause the application to terminate abnormally or execute...

The vulnerability of the ASMkern229A.dll and ASMBASE229A.dll libraries, which are software components for modeling, design, and drawing in AutoCAD, allows a malicious actor to cause an unexpected termination of the application or execute arbitrary code.

The vulnerability of the ASMkern229A.dll and ASMBASE229A.dll libraries, which are software components for modeling, design, and drafting in AutoCAD, relates to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow an attacker to cause the application to terminat...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-768)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-768 advisory. A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model...

The vulnerability of the libodxdll.dll library in the AutoCAD modeling, design, and drafting software allows a perpetrator to execute arbitrary code.

The vulnerability of the libodxdll.dll library in the AutoCAD modeling, design, and drawing software is related to a memory reclamation error. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a specially created MODEL file from a remote location...

The vulnerabilities of the libraries atf_dwg_consumer.dll, rose_x64_vc15.dll, and libodxdll, which are part of the AutoCAD simulation, design, and drafting software, allow a malicious actor to execute arbitrary code.

The vulnerability of the atfdwgconsumer.dll, rosex64vc15.dll, and libodxdll libraries, which are used in AutoCAD software for simulation, design, and drafting, relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or perfo...